Tagged Questions

5
votes
3answers
329 views

How does KeePass master key derivation increase security?

I don't understand how KeePass key derivation increases the security of the password db at all. First I'll try to explain what I understood from the key derivation described here. I'll use some pseudo ...
8
votes
4answers
485 views

Is there any reason to show the same message for invalid username as password?

I've seen a security question/requirement that a website login return the same error message for invalid password as for non-existent user. The idea being that this it makes it impossible to discover ...
5
votes
2answers
575 views

Keeping user data private in a cloud environment like Google App Engine

I am writing an open-source Java application for Google App Engine (GAE). The application will let users create content that is intended to be private. I want to provide reasonable assurances that ...
10
votes
4answers
243 views

Can apps be trusted when requesting your credentials?

I recently bought a newsreader app for my tablet that connects to Google Reader. To do so, it required my Google account password. Isn't this effectively the same as handling the password to the ...
6
votes
4answers
2k views

How to implement a “Remember me” on a mobile app?

I would like to implement a "Remember Me" time-limited auto-login type feature on a mobile application (on Android). To start the app, the user must type in a username and password. For convenience, ...
49
votes
8answers
5k views

Can anyone provide references for implementing web application self password reset mechanisms properly?

We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address). My problem is that I ...